Healthcare Loyalty Programs: A Compliance-First Guide

Healthcare loyalty is not retail loyalty in scrubs. Rewarding a patient for choosing a provider, or for the care a federal health program pays for, can violate criminal law, not just a marketing guideline. In this category, compliance is not a review step at the end. It is the design.

This guide starts from the rules that govern patient inducements and works toward what is actually viable, because in healthcare the constraints come first and the mechanics follow. It describes the main frameworks, what they generally rule out, and the compliant paths that remain.

Key Takeaways

Why healthcare loyalty is different

In most categories, a poorly designed loyalty program wastes money. In healthcare, it can expose the organization to criminal liability, civil penalties, and exclusion from federal programs. The reason is that the mechanics loyalty relies on, rewarding a choice, are exactly what patient-inducement law restricts. A points balance that nudges a patient toward a particular provider or a federally reimbursed treatment is not just persuasive; it can be an unlawful inducement. That inversion, where the core loyalty mechanic is the compliance risk, is why healthcare programs have to be designed from the rules outward.

One distinction runs through all of this: much of the risk attaches specifically to business paid for by federal health programs. A program limited to cash-pay or commercially insured patients, with no federal-program nexus, generally has more room, though state law, commercial-payer rules, and HIPAA still apply. A carve-out is only as reliable as the program's ability to identify federal beneficiaries, including members with dual or changing coverage, so the eligibility check is itself a compliance control. Where federal beneficiaries and federally reimbursed care are involved, the constraints are at their strictest. Drawing that line for your setting is one of the first things to work out.

The rules that shape it

Five bodies of law matter most. None of the summaries below is legal advice, and all of them have detail and exceptions that apply differently to each situation.

The Anti-Kickback Statute

The federal Anti-Kickback Statute is a criminal law. It prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce or reward referrals for items or services reimbursable by a federal health care program such as Medicare or Medicaid. Remuneration is defined broadly and includes cash, gifts, gift cards, free or discounted services, and effectively anything of value. That breadth is what makes conventional loyalty mechanics risky, because points or rewards that steer a patient toward federally reimbursed care can be treated as inducement. The statute has safe harbors, and to be protected an arrangement must fit squarely in one and satisfy all of its requirements, so a program should be designed to fit a safe harbor rather than merely resemble it.

The Beneficiary Inducements CMP

Closely related is the Beneficiary Inducements civil monetary penalty, which prohibits offering remuneration to a Medicare or Medicaid beneficiary that the offeror knows or should know is likely to influence the beneficiary's choice of a particular provider, practitioner, or supplier. It carries its own exceptions, including for certain preventive care incentives and for items or services that promote access to care and pose a low risk of harm, and those exceptions are specific and conditional. Separately, OIG's policy statement on gifts of nominal value treats small non-cash gifts within its stated limits as outside the prohibition; cash and cash equivalents never qualify. The practical effect is that rewarding a federal beneficiary for choosing your practice or pharmacy for covered care is presumptively a problem unless an exception clearly applies.

HIPAA and patient data

Loyalty programs run on data, and in healthcare much of that data is protected health information. HIPAA's Privacy Rule limits how such information can be used and disclosed and restricts selling it without valid authorization. A program that wants to use a patient's health information to target rewards or communications needs the authorizations and safeguards in place, and usually a business associate agreement with any vendor that touches the data. Treating health data like retail purchase data is a compliance failure waiting to happen.

Health data outside HIPAA is not unregulated either. The FTC's Health Breach Notification Rule applies to vendors of personal health records that HIPAA does not cover, and some states protect consumer health data directly: Washington's My Health My Data Act requires valid authorization before consumer health data is sold, and its definition reaches health inferences drawn from purchases. A health retailer's front-of-store loyalty data can fall into that category, so map which privacy regime applies to each data field before the program collects it.

State laws and the Stark Law

State laws add further limits. Some states restrict rebates, fee-splitting, or inducements by licensed providers, and some extend those limits to discounts and free services offered to patients. Separately, the federal Stark Law governs physician self-referral for designated health services. None of this replaces advice specific to your state and setting; together it means the compliant design space in healthcare is narrower than in most consumer categories.

What this generally rules out

Before the viable paths, it helps to name the mechanics that are usually off the table. Each is a potential violation, not merely a weak idea.

• Rewarding a patient for choosing a particular provider, practice, or pharmacy for federally reimbursed care.
• Points or rewards tied to prescriptions or services paid for by Medicare or Medicaid, outside a clear exception.
• Routinely waiving copays or deductibles as an incentive to attract federal beneficiaries.
• Using protected health information to power a loyalty program without authorization and safeguards.

What actually works

Within those limits, several models are viable. The common thread is that the reward attaches to something other than a federally reimbursed clinical choice.

Retail and front-of-store loyalty

The most established compliant path is retail. A pharmacy or health retailer can run a loyalty program on general merchandise and cash-pay items much as any store does. The Affordable Care Act added a retailer rewards exception to the Beneficiary Inducements CMP. Under it, coupons, rebates, or other rewards from a retailer, including a pharmacy, can reach Medicare and Medicaid beneficiaries if they are offered on equal terms to the general public regardless of insurance status and are not tied to items or services those programs pay for. State law may still restrict it. It is a real path, but a narrow one whose criteria each program has to meet.

The myWalgreens program shows the pattern in practice. Its terms and conditions (effective May 21, 2024) bar Walgreens Cash rewards for transferring a prescription by any member who is, or in the prior six months was, a beneficiary of Medicare, Medicaid, TRICARE, or another federally funded health program, and they exclude prescription-based rewards at pharmacies in Arkansas, New Jersey, and New York and on prescriptions transferred to stores in Alabama, Mississippi, Oregon, Puerto Rico, Tennessee, and Virginia. That shows one retailer's design choice, not a legal ruling, but it illustrates the carve-out structure this guide recommends: keep the retail program and carve the federally sensitive prescription behavior out of the earning rules.

Wellness and prevention engagement

Rewarding healthy behaviors, education, and engagement with wellness resources can work when the reward is for the behavior rather than for choosing a provider or for federally reimbursed treatment. The Beneficiary Inducements CMP also has an exception for certain incentives that promote the delivery of preventive care, with limits: no cash or instruments convertible to cash, and no incentive disproportionately large relative to the value of the preventive care. The design test is whether the reward would influence a clinical or provider choice that a federal program pays for; when it clearly would not, the ground is firmer.

Patient experience and administrative value

Not all value is remuneration. Making care easier to navigate, communications clearer, and the administrative experience smoother builds loyalty without offering an inducement at all. In a category where inducements are the central risk, non-monetary improvements to the experience are often the safest and most durable way to earn preference.

Payer and member wellness

Health plans engage members with wellness and rewards programs under rules specific to them. Medicare Advantage plans, for example, can run reward and incentive programs under 42 CFR 422.134, which bars cash, cash equivalents, and reduced cost sharing or premiums as rewards and prohibits designs based on achieving a health status measurement. These programs can be a compliant home for engagement mechanics that would be riskier at the provider level, again with program-specific legal guidance.

Where the value comes from

A compliant program still has to earn its cost, and in healthcare that cost includes legal review, exclusion rules, and ongoing monitoring. The value differs by path.

• Retail and front-of-store. A pharmacy visit is a frequent, predictable trip. A retail program can turn that trip into repeat purchases of non-reimbursed items and give the retailer purchase data it can act on, which is the same value logic as any retail loyalty program.
• Wellness and prevention. For a health plan or employer, engagement with preventive care and wellness resources can connect to the outcomes and costs they carry. The value depends on the behavior changing, not on the reward being claimed. Employer wellness incentives can also raise questions under HIPAA's nondiscrimination rules and the ADA and GINA, so check the design against those rules.
• Patient experience. Easier scheduling, clearer communication, and smoother administration can earn preference at low cost and with little inducement risk, because improving how care is delivered generally gives the patient nothing of value; free items or services to patients are remuneration and need their own review.

The trade-off is real. Exclusions remove some of the behaviors members would most like to be rewarded for, and a program that has been stripped of its most engaging mechanics can fail to change behavior at all. If the compliant design space for your setting is too narrow to reward anything members value, a non-monetary experience program may be the better investment than a points program.

How to measure a compliant program

Measure two things: whether the program works, and whether it stays inside the rules.

• Business results by path. For retail programs, track active members, repeat visits, and basket size on eligible items. For wellness programs, track participation in the rewarded activities and whether participants keep them up. For experience improvements, track patient satisfaction and retention.
• Compliance as a metric. Test the earning rules regularly: sample transactions to confirm that excluded items and excluded members never earn, log any exception found and how it was fixed, and track complaints about rewards. A gap found in testing is a design fix; a gap found in an audit is an exposure.
• Attribution with care. Members who join a health program are often already the most engaged patients or customers, so comparing members with non-members overstates the effect. Compare against a similar group or a pre-enrollment baseline, and treat the result as directional.

How to design a compliant healthcare loyalty program

The sequence puts the law first, deliberately.

• Start with the rules, not with the mechanic. The first question is what the applicable laws allow, not what would be most engaging.
• Map every reward against the Anti-Kickback Statute, the Beneficiary Inducements CMP, and HIPAA. If a reward could influence a federally reimbursed choice, redesign it.
• Separate clinical from retail. Keep rewards on the retail and wellness side, away from federally reimbursed care, unless an exception clearly applies.
• Design to a specific exception or safe harbor and meet every element, rather than building something that merely resembles one.
• Protect PHI. Put authorizations, safeguards, and business associate agreements in place before any health data enters the program.
• For a novel arrangement, consider an OIG advisory opinion, which addresses how fraud and abuse authorities apply to the requesting party's existing or proposed arrangement.
• Document and monitor. Keep the compliance rationale on record and revisit it as the program and the rules evolve.

The table below maps common mechanics to their compliance risk and the compliant alternative.

This is general information, not legal advice.

Conclusion

In healthcare, the loyalty program that works is the one built inside the rules from the first sketch. The mechanics that feel obvious from retail, points for the visit or rewards for the prescription, are often the ones that create criminal exposure, while the compliant paths of retail, wellness, and experience are quieter but durable. Start with the rules, design to an exception rather than around it, and treat compliance as the foundation rather than the final check.

Sources

• HHS Office of Inspector General, "Fraud & Abuse Laws" (Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b); Beneficiary Inducements CMP, 42 U.S.C. § 1320a-7a(a)(5); Stark Law; exclusion; copay waivers)
• 42 CFR 1003.110, definition of remuneration, including the preventive care, access to care, and retailer rewards exceptions (eCFR)
• HHS, HIPAA Privacy Rule guidance on marketing and sale of protected health information
• HHS, HIPAA guidance on business associates
• HHS OIG final rule, "Revisions to the Safe Harbors Under the Anti-Kickback Statute and Civil Monetary Penalty Rules Regarding Beneficiary Inducements" (Federal Register, December 7, 2016)
• HHS Office of Inspector General, Policy Statement Regarding Gifts of Nominal Value to Medicare and Medicaid Beneficiaries (December 7, 2016)
• 42 CFR 422.134, Medicare Advantage reward and incentive programs (eCFR)
• Federal Trade Commission, Health Breach Notification Rule (16 CFR Part 318)
• Washington State Office of the Attorney General, My Health My Data Act
• HHS Office of Inspector General, Advisory Opinions
• Walgreens, myWalgreens Terms and Conditions (effective May 21, 2024)